bugGNU Octave - Bugs: bug #51533, heap-buffer-overflow in...

 
 

bug #51533: heap-buffer-overflow in Sparse.cc-tst

Submitted by:  Dmitri A. Sergatskov <dasergatskov>
Submitted on:  Sat 22 Jul 2017 12:00:11 AM UTC  
 
Category: InterpreterSeverity: 3 - Normal
Priority: 5 - NormalItem Group: Segfault, Bus Error, etc.
Status: FixedAssigned to: None
Originator Name: Dmitri A. SergatskovOpen/Closed: Closed
Release: devOperating System: GNU/Linux

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Mon 24 Jul 2017 03:53:42 AM UTC, comment #11:

I cleaned up the patch to use more modern C++11 syntax and then pushed it here (http://hg.savannah.gnu.org/hgweb/octave/rev/10136bfd46a3). Closing report.

Rik <rik5>
Project Administrator
Mon 24 Jul 2017 12:51:15 AM UTC, comment #10:

With the patch applied it passes the test.

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Mon 24 Jul 2017 12:36:30 AM UTC, comment #9:

I reviewed lex.ll and the heap buffer overflow supposedly occurs with a read supposedly on this line of code.

I suspect that it actually is the line before, but the error reporting is slightly off.

This could cause a problem if, for example, current_input_line was empty so that the length was 0. In this case the index would be [-1] which could trigger this.

To debug this I modified the code slightly (there is a diff attached to the bug report). Could you apply the diff with "patch -p1 < lex.diff", rebuild, and then run "test liboctave/array/Sparse.cc-tst" as before. Even if it segfaults, I expect the diagnostics will be better and be localized to the 'char c' line.

(file #41308)

Rik <rik5>
Project Administrator
Sun 23 Jul 2017 12:31:27 AM UTC, comment #8:

Attached.

Dmitri.
--

(file #41293)

Dmitri A. Sergatskov <dasergatskov>
Sun 23 Jul 2017 12:25:32 AM UTC, comment #7:

I'm using gcc 5.4 which explains why I'm not getting the "stack-use-after-scope" warnings.

The first heap buffer overflow (from Sparse.cc-tst) is

Could you upload lex.ll so that I can match the exact source code against the error report?

Rik <rik5>
Project Administrator
Sat 22 Jul 2017 06:00:55 PM UTC, comment #6:

I think you need at least gcc 7 to get "stack-use-after-scope" diagnostic:

https://gcc.gnu.org/gcc-7/changes.html

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Sat 22 Jul 2017 05:56:33 PM UTC, comment #5:

On "test libinterp/octave-value/ov-class.cc-tst" I get

which I assume is false positive per the HINT.
(I get this error in many tests).

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Sat 22 Jul 2017 05:41:33 PM UTC, comment #4:

HG ID for this build is "d891b6a16a4d"

'-fno-omit-frame-pointer' seems to help with diagnostic (gives line numbers). But the errors still there.

Also the same in

and few others like that.

Dmitri.
--

(file #41291)

Dmitri A. Sergatskov <dasergatskov>
Sat 22 Jul 2017 05:07:35 PM UTC, comment #3:

I built it without java, qt, and fltk.
I will try with '-enable-address-sanitizer-flags'.

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>
Sat 22 Jul 2017 05:02:44 PM UTC, comment #2:

Instead of changing the CXXFLAGS manually, I configured with '-enable-address-sanitizer-flags'. This also adds '-fno-omit-frame-pointer'. I don't get a segfault in ov-fcn-handle.cc, but I do get one in test libinterp/octave-value/ov-class.cc-tst. Using gdb, the problem seems to be within the Java JVM: /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/amd64/server/libjvm.so.

Rik <rik5>
Project Administrator
Sat 22 Jul 2017 12:28:38 AM UTC, comment #1:

The same (?) problem shows up in some other tests:

Dmitri A. Sergatskov <dasergatskov>
Sat 22 Jul 2017 12:00:11 AM UTC, original submission:

compiled with fsanitize=address.
Running
results in
Full error log is attached.

Dmitri.
--

Dmitri A. Sergatskov <dasergatskov>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #41308:  lex.diff added by rik5 (697B - text/x-patch)
file #41293:  lex.ll added by dasergatskov (100KiB - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by rik5 (Posted a comment)
  • -unavailable- added by dasergatskov (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only project members can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 24 Jul 2017 03:53:42 AM UTCrik5StatusIn Progress=>Fixed
      Open/ClosedOpen=>Closed
    Mon 24 Jul 2017 12:36:30 AM UTCrik5Attached File-=>Added lex.diff, #41308
      StatusWorks For Me=>In Progress
    Sun 23 Jul 2017 12:31:27 AM UTCdasergatskovAttached File-=>Added lex.ll, #41293
    Sat 22 Jul 2017 05:41:33 PM UTCdasergatskovAttached File-=>Added sparse_overflow_err_2.txt, #41291
    Sat 22 Jul 2017 05:02:44 PM UTCrik5StatusNone=>Works For Me
    Sat 22 Jul 2017 12:00:11 AM UTCdasergatskovAttached File-=>Added sparse_overflow_err.txt, #41285

    Back to the top


    Powered by Savane 3.1-cleanup1